YARAify Scan Results

Task Information

---

Task ID:	e46070d5-7156-11ef-b6ec-42010aa4000b
File name:	3216_353232010322212492024
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Trojan.Lamin-9815577-0 Alert Create hunting rule

Signature:	Win.Worm.Lamin-7565241-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	Detect_APT29_WINELOADER_Backdoor Alert Create hunting rule
Author:	daniyyell
Description:	Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:	https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Detect_Malicious_VBScript_Base64 Alert Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Alert Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	SEH__vba Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	test_Malaysia Alert Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.